Reduce REGEXP_TIMEOUT_SECONDS to 40 seconds
What does this MR do and why?
A new global Regexp
timeout option was introduced in Ruby 3.2 to mitigate Regular Expression Denial of Service (REDoS) issues.
- We set it to 50 seconds in Set Global timeout for Regexp to prevent ReDOS (!145679 - merged)
- We set it to 45 seconds in Reduce REGEXP_TIMEOUT_SECONDS to 45 seconds (!174854 - merged)
We are monitoring timeout errors in #499848, there were none since lowering from 50 to 45 a month ago.
This MR lowers the timeout value from 45 to 40 seconds to further reduce the impact of an attempt to exploit REDoS.
References
Please include cross links to any resources that are relevant to this MR. This will give reviewers and future readers helpful context to give an efficient review of the changes introduced.
MR acceptance checklist
Please evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.
Screenshots or screen recordings
N/A
How to set up and validate locally
N/A
Merge request reports
Activity
changed milestone to %17.8
added security typemaintenance labels
assigned to @dcouture
mentioned in issue #499848
added pipelinetier-1 label
added backend label
Reviewer roulette
Category Reviewer Maintainer backend @sam.figueroa
(UTC+0, same timezone as author)
@lma-git
(UTC-8, 8 hours behind author)
Please refer to documentation page for guidance on how you can benefit from the Reviewer Roulette, or use the GitLab Review Workload Dashboard to find other available reviewers.
If needed, you can retry the
danger-review
job that generated this comment.Generated by
DangerEdited by ****- Resolved by Grzegorz Bizon
@lwanko can you review this MR please? Thanks!
requested review from @lwanko
added pipeline:mr-approved label
requested review from @grzesiek
added pipelinetier-2 label and removed pipelinetier-1 label
Before you set this MR to auto-merge
This merge request will progress on pipeline tiers until it reaches the last tier: pipelinetier-3. We will trigger a new pipeline for each transition to a higher tier.
Before you set this MR to auto-merge, please check the following:
- You are the last maintainer of this merge request
- The latest pipeline for this merge request is pipelinetier-3 (You can find which tier it is in the pipeline name)
- This pipeline is recent enough (created in the last 8 hours)
If all the criteria above apply, please set auto-merge for this merge request.
See pipeline tiers and merging a merge request for more details.
E2E Test Result Summary
allure-report-publisher
generated test report!e2e-test-on-gdk:
test report for d2fc6336expand test summary
+------------------------------------------------------------------+ | suites summary | +-------------+--------+--------+---------+-------+-------+--------+ | | passed | failed | skipped | flaky | total | result | +-------------+--------+--------+---------+-------+-------+--------+ | Plan | 82 | 0 | 8 | 0 | 90 | ✅ | | Create | 138 | 0 | 20 | 0 | 158 | ✅ | | Govern | 80 | 0 | 12 | 0 | 92 | ✅ | | Manage | 0 | 0 | 10 | 0 | 10 | ➖ | | Data Stores | 33 | 0 | 10 | 0 | 43 | ✅ | | Verify | 50 | 0 | 20 | 0 | 70 | ✅ | | Monitor | 8 | 0 | 12 | 0 | 20 | ✅ | | Package | 25 | 0 | 13 | 0 | 38 | ✅ | | Secure | 4 | 0 | 3 | 0 | 7 | ✅ | | Release | 5 | 0 | 1 | 0 | 6 | ✅ | | Analytics | 2 | 0 | 0 | 0 | 2 | ✅ | | Fulfillment | 2 | 0 | 7 | 0 | 9 | ✅ | | Configure | 0 | 0 | 3 | 0 | 3 | ➖ | | ModelOps | 0 | 0 | 1 | 0 | 1 | ➖ | | Ai-powered | 0 | 0 | 2 | 0 | 2 | ➖ | | Growth | 0 | 0 | 2 | 0 | 2 | ➖ | +-------------+--------+--------+---------+-------+-------+--------+ | Total | 429 | 0 | 124 | 0 | 553 | ✅ | +-------------+--------+--------+---------+-------+-------+--------+
e2e-test-on-cng:
test report for d2fc6336expand test summary
+------------------------------------------------------------------+ | suites summary | +-------------+--------+--------+---------+-------+-------+--------+ | | passed | failed | skipped | flaky | total | result | +-------------+--------+--------+---------+-------+-------+--------+ | Create | 143 | 0 | 19 | 0 | 162 | ✅ | | Data Stores | 33 | 0 | 10 | 0 | 43 | ✅ | | Verify | 51 | 0 | 19 | 0 | 70 | ✅ | | Package | 30 | 0 | 14 | 0 | 44 | ✅ | | Plan | 86 | 0 | 8 | 0 | 94 | ✅ | | Fulfillment | 2 | 0 | 7 | 0 | 9 | ✅ | | Monitor | 8 | 0 | 12 | 0 | 20 | ✅ | | Secure | 2 | 0 | 5 | 0 | 7 | ✅ | | Govern | 84 | 0 | 10 | 0 | 94 | ✅ | | Configure | 0 | 0 | 3 | 0 | 3 | ➖ | | Manage | 0 | 0 | 10 | 0 | 10 | ➖ | | Ai-powered | 0 | 0 | 2 | 0 | 2 | ➖ | | Release | 5 | 0 | 1 | 0 | 6 | ✅ | | ModelOps | 0 | 0 | 1 | 0 | 1 | ➖ | | Analytics | 2 | 0 | 0 | 0 | 2 | ✅ | | Growth | 0 | 0 | 2 | 0 | 2 | ➖ | +-------------+--------+--------+---------+-------+-------+--------+ | Total | 446 | 0 | 123 | 0 | 569 | ✅ | +-------------+--------+--------+---------+-------+-------+--------+
Edited by ****added 1163 commits
-
412536d7...4bd5f2ff - 1162 commits from branch
master
- d2fc6336 - Reduce REGEXP_TIMEOUT_SECONDS to 40 seconds
-
412536d7...4bd5f2ff - 1162 commits from branch
added pipelinetier-3 pipeline:run-e2e-omnibus-once labels and removed pipelinetier-2 label
added this merge request to the merge train at position 2
- Resolved by Dominic Couture
Thanks, LGTM
removed this merge request from the merge train because the pipeline did not succeed. Learn more.
Hey there
, could you please make sure this merge request gets merged?The merge request is set to auto-merge, but it is not currently mergeable (MR
detailed_merge_status
is discussions_not_resolved).This message was generated automatically. Improve it or delete it.
started a merge train
removed this merge request from the merge train because the pipeline did not succeed. Learn more.
started a merge train
mentioned in commit b7e9c5c8
added workflowstaging-canary label
added workflowcanary label and removed workflowstaging-canary label
added workflowstaging label and removed workflowcanary label
added workflowproduction label and removed workflowstaging label
added workflowpost-deploy-db-staging label and removed workflowproduction label
added workflowpost-deploy-db-production label and removed workflowpost-deploy-db-staging label